All Questions

9
votes
2answers
2k views

How do I get started using ESAPI WAF?

I've been to the OWASP Enterprise Security API (Java Edition) Google Groups page and found this information missing.
8
votes
1answer
556 views

Are browser still vulnerable to Cross-Site Cooking?

The latest article that I have been able to find about Cross-Site cooking was stating that it was possible to set cookie on 2 dots top level domain such as .co.uk. The mechanism for preventing ...
13
votes
4answers
6k views

Does a webserver need an antivirus software installed?

In what cases does a webserver need an antivirus software installed? When it is not required? If it is required sometimes, what should be considered when choosing the right one to install? (In my ...
7
votes
2answers
898 views

Recently had a virus, can I use backed up files on clean system?

I had to reinstall my OS (windows) recently due to a virus. I backed up my source files onto a flash drive. How can I get to those files without problems? I know flash drives can have nasty things in ...
24
votes
2answers
3k views

How can a Software application defend against DoS or DDoS?

Most of the solutions for DoS attacks are not at the application level. In case I am using a proxy server, what are the possible countermeasures for DoS at the application level?
9
votes
4answers
288 views

Defending site against being abused by phishing

Say you have a web site and you are using some returnUrl URL parameter to redirect user back to page where he was after login or editing some records in user area. Is there some standard way how to ...
17
votes
3answers
2k views

What steps should be taken to validate user uploaded images within an application?

Recently I have worked on a number of applications that need to process user uploaded images steps have been taken to validate the extension and the mime type. But what else can be done to ensure ...
27
votes
8answers
2k views

When a sysadmin leaves what extra precautions need to be taken?

If a user leaves an organisation who knew most of the top credentials are there any other precautions that need to be taken other than changing those credentials? Obviously there is also the standard ...
21
votes
3answers
559 views

Startup security

I'm running a lean start-up, and I can't afford to pay a dedicated security expert, what types of precautions can I take? These would need to be cheap, simple to implement, and require minimal time ...
12
votes
5answers
2k views

Automated tools vs. Manual reviews

What are the advantages of using automated tools, as opposed to manual review? What are the disadvantages? This applies both to external blackbox vulnerability scanning, and to static code analysis. ...
17
votes
3answers
3k views

White-box vs. Black-box

What are the relative advantages and disadvantages of each form of testing? I.e. What is the difference between static code analysis and runtime/dynamic penetration testing? What are the pros and cons ...
10
votes
4answers
172 views

Is external vuln scanning sufficient?

Is running an automated application vulnerability scanner sufficient to certify our application is secure? Why isn't it? From the original Area51 proposal.
283
votes
11answers
50k views

How to securely hash passwords?

If I hash passwords before storing them in my database, is that sufficient to prevent them being recovered by anyone? I should point out that this relates only to retrieval directly from the ...
9
votes
2answers
204 views

Online SQL Server database for a Business app. Security considerations

A business application works with a SQL Server database. A SQL Server 2008 is installed on one of the computers of the local network. Technically this app works OK if the server computer with the SQL ...
23
votes
10answers
4k views

Vulnerable OS's?

Which vulnerable OS's like for example DVL would you recommend for someone to use for the purpose of pentest/exploitation learning?
8
votes
5answers
410 views

Encrypting a disk that has stuff on it?

Ok, so a pretty big disk ~1-2TB (90% full, multiple partitions + 2 operating systems on it), needs to be encrypted and zeroed-out, and it's a bit too much data for backing it all up before encryption. ...
9
votes
7answers
671 views

If I suspect my server is compromised then should I disconnect it immediately or not? From Power or Network?

According to Mandiant, you should not: Mistake #1: Immediately entering “remediaton mode” – also known as playing “Whack-A-Mole” ... as described here: http://blog.mandiant.com/archives/1525 ...
8
votes
5answers
1k views

Creating tunnel with most ports closed?

How can I create a proxy tunnel from a network that has all ports but port 80 closed? I guess I'd have to bind SSH on my server to port 80, but would that introduce problems to my home network since ...
39
votes
5answers
4k views

New XSS cheatsheet?

There is a great list of XSS vectors avaliable here: http://ha.ckers.org/xss.html, but It hasn't changed much lately (eg. latest FF version mentioned is 2.0). Is there any other list as good as this, ...
12
votes
3answers
587 views

How do you defend specifically against attackers utilizing any or all of the commercial exploit kits?

There are several commercial exploit kits available containing 0day vulnerabilities: White Phosphorus Exploit Pack http://www.immunityinc.com/products-whitephosphorus.shtml Agora Exploit Pack ...
20
votes
4answers
10k views

What is the correct way to implement anti-CSRF form tokens?

I am fully aware of CSRF and have already implemented some safe forms, but I have never been happy with the results yet. I've created tokens as a md5 of username, form info and a salt and stored it ...
18
votes
4answers
1k views

What type of content better not to transfer by email?

Email is one of the main tools of business communication. On the other hand, it is not a secure way of communication. But to what extent it is not secure? I have always wondered how sensible it is ...
15
votes
6answers
939 views

What are a few good lists of threats to use to kick-off conversations with others about what worries them?

To effectively communicate with business owners or executives on security, specifically with how people may harm their business, it often helps to discuss what types of people worry them. What are ...
22
votes
4answers
584 views

How does using OpenID affect webapp security?

Using OpenID for authenticating users grows in popularity and, in fact, makes a webapp easier to use. But what are the security considerations one should bear in mind when deciding whether to ...
4
votes
2answers
1k views

Web Crawler for ASP.NET site

Do you know any crawler/spider software, which is able to go through ASP.NET application, not ASP.NET MVC, but the one full of __doPostBack JavaScript functions on every link/button/change event? If ...
9
votes
4answers
1k views

What is the right way of storing database connection strings from the security point of view?

What are recommendations, best practices and have-to-dos regarding handling connection strings in web applications? What things one should never, ever do?
11
votes
4answers
1k views

What kinds of SSL certificates are usable for encryption?

I know that Verizon SSL certificates cost close to $600. There are couple of cheap alternatives, but I never really understood why Verizon does not offer such certificates. Look for RapidSSL at ...
34
votes
9answers
9k views

How long should the password be?

The minimum password length recommended is about 8 characters, so is there any standard/recommended maximum length of the password?
23
votes
9answers
8k views

Do secure phone lines exist?

I could be out of context here about security, but , I would like to know if phone lines or phone calls over VOIP could be made secure . I know that Skype and other VOIP service providers have to ...
18
votes
7answers
2k views

What are some good website security scanning solutions?

What are some good web-based website security scanning solutions? I'm not too concerned if they are web-based solutions, or software that can be run locally. Generally, I'm looking for something we ...
11
votes
4answers
309 views

What free tools or techniques exist to discover anomalies in network flows?

I have been using FlowMatrix. What do others do on the cheap?
13
votes
1answer
194 views

Is there a list of default, standard or third-party “users” for Oracle?

When installed, and depending on which options it is installed with, there are a bunch of standard users pre-created in Oracle. Additionally, third-party software often has its own set of ...
10
votes
2answers
1k views

Is there a benefit in using Oracle's WRAP to obfuscate PL/SQL Code

Oracle stored program units (procedures, functions, packages and types) can be obfuscated using the WRAP functionality. Apart from the generic arguments about 'security through obscurity' are there ...
23
votes
8answers
10k views

Can I detect web app attacks by viewing my Apache log file?

I occasionally get clients requesting I look at their access_log file to determine if any web attacks were successful. What tools are helpful to discern attacks?
7
votes
4answers
262 views

How to determine whether site is secure from common user's point of view?

What should be done (or at least declared) so end-users, visitors will start trusting your website? Some thoughts: secured login (via https) privacy policy (hidden email and other private ...
40
votes
6answers
13k views

What techniques do advanced firewalls use to protect againt DoS/DDoS?

It is hard to protect a server against Denial of Service attacks, DoS/DDoS. The two simple ways I can think of is to use a server with much resources (e.g. CPU and memory), and to build the server ...
12
votes
2answers
288 views

What is the best way to verify the SSL configuration of my web server?

How do I ensure I have my SSL configuration setup securely?
11
votes
3answers
296 views

What are the pros/cons of using a threat detection system?

What are the pros/cons of using a threat detection system for a web app (like OWASP's AppSensor)? What does a properly implemented threat detection system do and how does it behave when it detects ...
18
votes
1answer
662 views

Is it secure to connect to a remote Windows Server using Remote Desktop only?

I have a Windows Server that I login to from my home. I only use the pre-installed Remote Desktop. Is this a secure way to remote login or should I improve it in some way? If I should improve it, ...
24
votes
2answers
19k views

How can I check that my cookies are only sent over encrypted https and not http?

I read a blog post GitHub moves to SSL, but remains Firesheepable that claimed that cookies can be sent unencrypted over http even if the site is only using https. They write that a cookie should be ...
15
votes
8answers
1k views

Password management/synchronization?

Is there a good enough service I could run on my own home (Linux) server that I could use for storing/accessing/synchronizing passwords so they could be available for me from multiple ...
16
votes
5answers
1k views

Is Google Chrome a better secured browser?

I was amazed that IE 8, Safari, Firefox were hacked so fast. Is it really Chrome so good or it was not tested? Has anyone other results of independent investigations about security of web browsers? ...
25
votes
5answers
3k views

Professional certifications for IT Security

Which credentials of the sub-list of IT certifications (as per the Information Systems Security Association) would be considered MUST HAVE for a IT Security specialist. Information Security CEH ...
27
votes
7answers
4k views

Does it matter which Certificate Authority I source my SSL Certificate from?

To secure my web site with HTTPS, does it matter which company I source my SSL certificate from, or just that the browser recognizes it? From the Area51 proposal.
28
votes
9answers
14k views

Feeding /dev/random entropy pool?

Which way of additionally feeding /dev/random entropy pool would you suggest for producing random passwords? Or, is there maybe a better way to locally create fully random passwords?
20
votes
8answers
2k views

What cryptographic algorithms are not considered secure?

What cryptographic algorithms are not considered secure, but yet are still widely used and available in standard libraries? If applicable, mention a secure alternative.
78
votes
14answers
17k views

Apache Server Hardening

What are some best practices, recommendations, required reading for securing an Apache Server?
19
votes
5answers
1k views

Designing in zero day attack mitigations

What are best practices / recommendations / strategies for mitigating zero day threats/attacks from a software development perspective?
10
votes
7answers
684 views

IP address black list

My website has a black list of IP addresses. The web application, in some way, detects all invalid, suspicious influences to it and remembers IP address and denies any requests from that IP address. ...
17
votes
3answers
2k views

How to keep a shared web hosting server secure?

What are the ways of keeping a shared LAMP server secure, assuming SSH access is available for every user? Edit: I am mainly thinking of securing the server from the users themselves and between ...

15 30 50 per page